CVE-2026-10898: Stack buffer overflow in GPU in Google Chrome prior to 149

Synopsis

A stack-based buffer overflow in the GPU component of Google Chrome (versions prior to 149.0.7827.53) is reachable over the network and requires no authentication. An attacker who has already compromised the Chrome renderer process can trigger the overflow by delivering a crafted HTML page, which enables a sandbox escape giving the attacker code execution at the privilege level of the browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page to a target Chrome instance.

• AuthenticationNot required

  No credentials or account are required to deliver the malicious page to the target browser.

• Victim interactionRequired

  The target user must navigate to or open the crafted HTML page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Exploitation is rated high complexity because it requires the attacker to have already compromised the Chrome renderer process before triggering the GPU overflow.

Blast Radius

• A successful attacker escapes the Chrome sandbox and executes arbitrary code at the privilege level of the browser process.
• With sandbox escape achieved, the attacker reads files, credentials, and session data accessible to the browser on the host.
• The attacker can write to the filesystem or modify browser-managed data, including saved passwords and stored cookies.
• The attacker can crash or destabilize the browser process, causing a denial of service for the affected user.